Securing product storage tanks against unauthorized delivery

ABSTRACT

A system and method prevent product-type contamination in a bulk liquid storage tank. A control unit receives an indication of a storage product type in the bulk storage and a delivery product type in the tanker truck. The control unit compares the delivery product type with the storage product type and controls delivery based on a result of the comparison.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/358,736, filed Nov. 22, 2016, now U.S. Pat. No. 9,964,962, which is acontinuation of U.S. patent application Ser. No. 14/117,562, filed Nov.13, 2013, now U.S. Pat. No. 9,523,978, which is the U.S. national phaseof PCT International Patent Application No. PCT/US2012/050287 filed Aug.10, 2012, which claims the benefit of U.S. Provisional PatentApplication No. 61/522,502, filed Aug. 11, 2011, the entire contents ofeach of which are hereby incorporated by reference in this application.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

(NOT APPLICABLE)

BACKGROUND

The invention relates to product delivery control and, moreparticularly, to securing product storage tanks against unauthorizeddelivery.

Retail facilities selling liquid products stored in liquid storage tanks(e.g., gas stations) are located throughout the world. In the case ofpetroleum, products are stored in bulk storage tanks, which aretypically located underground. Each tank stores a unique petroleumproduct (e.g., gasoline, diesel, kerosene, etc.) to be dispensed throughpump-dispensers at various retail facilities. The delivery of petroleumproducts (hereinafter, fuel) to retail facilities is conducted by agravity drop from a compartment in a tanker truck. These tanker trucksare themselves loaded for delivery from larger tank systems located atwholesale distribution centers.

Preventing unauthorized fuel delivery is desirable for automotive fuelbrands to maintain their brand products' exclusivity in the franchiseretail gas stations, for fuel distributors in order to fulfill theirexclusive relationships with retail gas stations, and to preventcontamination or improper mixing of fuel products. A business goal offuel distributors is to minimize unauthorized deliveries whilemaximizing the efficiency of authorized delivery operations.Unauthorized deliveries may take place at a time of fuel pricefluctuations. When prices go down, the owner of a retail gas stationmight be tempted to purchase fuel from a freelance distributer at alower price, breaching the long-term supply contract with a distributor.

Typically, distributors keep close track of their customers' inventory,but in practice, even with well monitored retail gas stations,distributors report that unauthorized deliveries cause them a loss of2-20% of their total business. That is a loss of between 1.75 millionand 17.5 million PER DAY for authorized distributors in the UnitedStates during the first six months of 2011 (calculation based on datafrom the Prime Supplier Report and the U.S. Energy InformationAdministration, which report that in the first half of 2011, totalgasoline sales and deliveries was approximately 350 million gallons perday with an average distributor's margin of 50.25 per gallon).

Current methods for preventing unauthorized delivery of liquid cargointo a storage tank includes the collection and comparison ofpoint-in-time storage tank levels, storage volume history and deliveryrecords for a retail station. If a deviation is found, the dealerrepresentative works with the retail station manager to investigate andcorrect the situation. This method fails to prevent unauthorizeddelivery because (a) it is post factum and, under the circumstances, itis difficult to prove wrongdoing, (b) an investigation typically has anegative effect on the distributor-customer relationship, (c) it iscostly, and (d) it doesn't provide a means to prevent product-typecontamination due to human error.

Remote controlled valves have been previously used in other industries(e.g., water irrigation system), but have not been suitable for fuel orother industrial liquid products because (a) they do not support bulkliquid drops at very low hydrostatic pressure, (b) they are noteffective for bidirectional flow, (c) they are hard to use in aflammable explosive environment, (d) they are not suited for batteryoperation due to energy consumption, and (e) they are typicallyunreliable, expensive, and difficult to use. The RCVs used herein aresuitable for allowing rapid bulk-liquid drops at any hydrostaticpressure, supporting bi-directional liquid flow and handling flammableliquids securely, including supporting ongoing maintenance, inspectionand auditing activities without compromising on safety or security.

BRIEF SUMMARY

The described embodiments overcome the shortcomings of existing deliverysystems by (a) providing automatic, real-time prevention of unauthorizeddeliveries, (b) eliminating post factum investigations, (c) minimizingthe size of the professional control team, and (d) ensuring the qualityof the delivered product by preventing contamination.

The described embodiments are independent of the delivered product typeand are applicable for any industrial product (liquid or otherwiseflowable, e.g., granular) for which unauthorized delivery orcontamination by improper mixing of product types can occur. Forconvenience, the Detailed Description is provided in terms of fueldistribution, which is a highly applicable market for the describedembodiments. The challenges faced by distributors in the fuel market arealso the same as in other markets, e.g., milk, juice or hazardousagricultural liquids such as fertilizers and pesticides.

In an exemplary embodiment, a method of preventing contamination by atanker truck in a bulk liquid storage tank may include the steps of (a)providing an identification transmitter at an entry port of the bulkliquid storage tank, the identification transmitter storing anindication of a storage product type in the bulk storage tank; (b)communicating a delivery product type in the tanker truck to controlcircuitry in the tanker truck; (c) the identification transmittercommunicating the storage product type to the control circuitry; and (d)the control circuitry comparing the delivery product type with thestorage product type and controlling delivery based on a result of thecomparison.

In another exemplary embodiment, a system for preventing contaminationby a tanker truck in a bulk liquid storage tank may include anidentification transmitter positioned adjacent an access to the bulkliquid storage tank, where the identification transmitter is configuredto store an indication of a storage product type in the bulk storagetank. A drop elbow may connect the tanker truck to the liquid storagetank, where the identification transmitter may include a sensor that isconfigured to identify when the drop elbow has been connected. Controlcircuitry communicating with the identification module may be configuredto identify a delivery product type in the tanker truck and to comparethe delivery product type in the tanker truck with the storage producttype. The control circuitry may be configured to control delivery of thedelivery product type based on a result of the comparison.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other aspects and advantages will be described in detail withreference to the accompanying drawings, in which:

FIG. 1 is a schematic drawing showing a general overview of the system;

FIG. 2 is a flowchart describing the method and process for initializingand installing the RCV;

FIG. 3 is a flowchart describing the method and process for initializingand installing the CCU;

FIG. 4 is a flowchart describing the method and process for authorizingdelivery of petroleum products at a retail gas station using the systemof the described embodiments;

FIG. 5 is an authorized delivery audible alerts state diagram;

FIG. 6 is a front-panel illustration CCU;

FIG. 7 is a physical view of the RCV installed in a spill container;

FIG. 8 is a detailed view of the RCV components and locking mechanism;

FIG. 9 is a block diagram of the CCU;

FIG. 10 is a block diagram of the RCV;

FIG. 11 is a block diagram of the PTDU; and

FIG. 12 is a schematic drawing of the PTDU.

DETAILED DESCRIPTION

The invention includes methods, systems, computer software and productsassociated with securing storage tanks against the unauthorized transferof flowable product from delivery vehicles (e.g., tanker trucks and railcars) or the unauthorized loading of products from a storage tank into adelivery vehicle.

With reference to the drawings, the system is comprised generally of aremote controlled valve (hereinafter, RCV), which is installed at theentry port of a liquid storage tank 210 and controls liquid flow into orout of the liquid storage tank 200. A command and control unit(hereinafter, CCU) 120 is installed in the cabin 110 of a tanker truck100 or in a handheld mobile device, which controls the delivery processand includes product type push buttons that open the RCV to full flow.Other components include a visual display 120-2, embedded audible alarm120-3 to report on delivery status, RCV status, and system errorindicator 102-5. A tanker has several compartments, each containing aspecific product. Product type display units (hereinafter, PTDUs) 160are installed next to each compartment dispensing port 130. The PTDU 160is manually set at the fuel depot station by the delivery person, whichtypically is the tanker truck driver, to display the type of product inthe associated compartment (e.g., diesel, regular gasoline, etc.) at thetime of product loading with optional active components that willcommunicate the product type to the CCU. The product type push buttoncan be also embedded in the PTDU 160-2. Each RCV carries savedinformation about the storage tank volume and product type. The deliveryperson will be required to confirm that the product type for delivery isthe same type as the one in the storage tank prior to the delivery bypressing the correct fuel type push button. Alternatively, this processcan be replaced by an automatic process with a front end interface 160-5(RF or wired), assuming the information about each compartment producttype will be stored during the loading time at the fuel depot by meansof retrieving the fuel depot loading arms at the time of loading.

A communication link between the CCU and the RCV ensures that only apre-authorized CCU is granted access privileges to unload fuel into aliquid storage tank.

Operational Process

An RCV is prepared and installed in accordance with the process, methodand computer program shown in FIG. 2. After initializing the RCV (S1),operational information for each RCV is registered in the logisticscenter database 300 (FIG. 1) (S2). The RCV is programmed with an RCVunique ID number, an operational password, gas station locations, fueltype, tank volume, and administrative password, etc. (S3). Subsequently,the operational information from the logistics center database is loadedin the RCV database (S4). The RCV is then installed at the entry port ofthe underground tank at the gas station in compliance with its embeddeddata (S5).

The RCV is mechanically compatible for integration with common top sealadaptors and is installed at the entry port of the fuel storage tank.After installation, access to the storage tank is blocked and can beopened only in response to an authorized CCU “Open” command.

The CCU is initialized at the logistics center and installed in thetanker's cabin or in a mobile hand-held terminal. The preparation andimplementation is achieved in accordance with the process, method andcomputer program shown in FIG. 3. CCU initialization is started in stepS10, and the operational information for each CCU is registered in thelogistics center database (S11). Operational data includes CCU IDnumber, truck ID, a list of served gas stations with RCV ID numbers andassociated passwords, etc. (S12). The CCU's database is loaded with theoperational information from the logistics center database (S13), andthe CCU is installed in the truck cabin and operation is validated(S14).

The Logistics Center provides a unique identification code for each RCVand CCU. At the time of installation, the CCU is loaded with a list ofgas stations' passwords where that tanker is certified for delivery. Thepasswords are loaded into the CCU's non-volatile memory and thereforeprotected against power failure.

When at least one tanker and at least one liquid storage tank areinstalled, system operations can begin in accordance to the processshown in FIG. 4, which shows the step-by-step operational procedures ofthe invention.

CCU

The CCU enables the delivery person to monitor and open RCVs at the timeof fuel delivery. The delivery person can only open RCVs that areauthorized for specific tanks at specific gas stations. The CCU isinstalled in the tanker truck's cabin in a way that is visible andconveniently accessible for the delivery person. FIG. 9 is a schematicblock diagram of the CCU. The electronic circuitry is comprised of aFront End Interface 120-7 (RF or wired), RISC μP system 120-6 loadedwith an operational program and database, a Power System 120-5, whichreceives its power from the tanker truck's battery; and a front panelthat is comprised of visual indicators 120-2 and an audible alarm 120-3.

The CCU is turned on at the retail gas station. Once operational with acommunications medium (RF or Wired) in place, the CCU starts searchingfor RCVs, and the operational process proceeds according to FIG. 4.

PTDU

The PTDU 160 (FIG. 11) is installed on the tanker truck next to eachcompartment dispensing port. The basic PTDU is a mechanical indicator,widely used today in the fuel delivery industry and set by the driver atthe fuel depot to remind him the type of product that was loaded intothe specific compartment. The PTDU discussed in this invention is anoptional accessory to the CCU, and it is comprised of (1) a display160-10 showing the product type stored in the linked compartment, (2) aselection knob 160-1 for selecting the product type to display at thetime of product loading, and (3) a push button 160-2 via a powerconverter 160-3 that sends a command to the CCU to open or close the RCValong with the product type shown on the display. The CCU could also beimplemented in a mobile hand-held device. Also, the fuel type pushbuttons can be installed at the PTDU, which is operationally convenient,and in which case it will constitute a “distributed” CCU.

RCV

The RCV is a low-power electromechanical valve system, controlled by anauthorized CCU, and designed to work with petroleum products and otherhazardous liquids. The RCV is installed at the entry port of anunderground liquid storage tank. In the gas station application, it isinstalled inside a spill container 210-19, screwed in between the bottomof the spill container at one end and a top seal adaptor at the otherend.

FIGS. 7 and 8 show the RCV's physical layout, and FIG. 10 is a schematicblock diagram. The RCV's mechanical parts are comprised from a disk flap210-10. The flap can be in an opened (90°) position or closed (0°)position (as shown in FIGS. 7 and 8). The flap is connected at its axisto a shaft or axle 210-11. The shaft provides a lock mechanism for theflap when it is in opened or closed positions and also has two magnets210-12 that pull ferromagnetic read switches 210-13 to report that theflap is opened, closed or half way open. The shaft is moved by a cam210-14 that is connected to a small electric motor 210-18 through aspring transmission 210-20 that preserves the energy in case ofmechanical obstruction to the flap to allow the motor to shut down,while waiting for the mechanical obstruction to be removed. The axle210-11 of the disk flap is secured to a cam plate 210-14, which includesa cam slot therein. A cam driver includes a cam pin disposed in the camslot. The cam pin and slot arrangement serves to lock the disk flap ineither the closed position or the opened position. A motor arm 210-15 isconnected to the other side of the transmission spring and is alsoequipped with a magnet 210-16 that activates ferromagnetic read switches210-17 to indicate a max position of the motor, and power to the motorcan be shut down. In use, the cam driver is coupled with the motor viathe spring transmission. The motor is operable to displace the springtransmission from a relaxed state to a compressed state regardless of aposition of the disk flap. The spring transmission is configured suchthat a force of the spring transmission in the compressed state issufficient to displace the disk flap from/to the opened position to/fromthe closed position.

With reference to FIG. 10, electronic parts of the RCV include an RF orwired Front End Interface 210-7, μP system 210-9 loaded with anoperational program and database, and a valve 210-2, whose open/closedstatus is controlled by a low-power drive 210-3. The low power drive isactivated by an electrical command sent from the RISC μP following arequest from an authorized CCU. The RCV is powered by an internalbattery 210-6.

Operational Process

The system has two modes of operations: (a) Delivery Mode and (b)Service mode. In the delivery mode, the RCV's drop elbow sensor 210-1detects a drop elbow 150 attached to the top seal adaptor for more thanfew seconds steadily. The RCV internal circuitry is activated, and thesystem attempts to establish communication with the CCU. The deliveryprocess is performed according to FIG. 4 (described below).

In the service mode, the valve may be opened for a limited time formaintenance purposes, e.g., measuring liquid level using a measuringrod. The maintenance person will have a service version of the CCU thatwould allow opening the valve for a short time. The service modeoperational process is described in FIG. 4.

Valve

The valve is normally closed, with liquid flow blocked. No power isrequired to hold the valve in this position. The valve is bi-directionalfor liquid flow. A closed valve, however, is capable to allow controlledleakage into the underground. This can be accomplished by the sizeand/or shape of the valve relative to the product entry port. Thiscapability is required to allow a return of a fuel sample taken foranalysis purposes, without requiring opening the valve. This rate ofcontrolled leakage should be low enough to cause no product mixingissues in the delivery mode if by mistake somebody is trying to deliverthe wrong fuel type.

FIGS. 4 and 5 show operational processes relating to product deliverywith the system of the described embodiments. With reference to FIG. 4,delivery is started in step S20, and a tanker truck 100 arrives at thegas station with a delivery order and parks next to the station's fueltank entry ports (S21). The delivery person uncovers and connects thevapor return port to the tanker vapor return port (S22). The storagetank entry port is uncovered, the cap is removed, and the drop elbow isconnected to the top seal adapter to connect the 4″ hose 140 between thetanker's compartment API and top seal adapters (S23). If the RCV sensesthe drop elbow transition (YES in S24), the RCV with drop elbowconnected enters into active mode and sends its location and ID to theCCU (S25). After receiving the RCV's location and ID, if the RCV is onthe CCU's authorized list (YES in S26), the CCU sends the location'spassword to the RCV (S27). If the RCV is not on the CCU's authorizedlist (NO in S26), the RCV returns to sleep mode (S28), and the processreturns to step S24. In step S24, if the RCV does not detect the dropelbow transition (NO in S24), the RCV remains closed, and its electroniccircuitry stays in sleep mode (S29). The system then waits until thedrop elbow transition is detected.

The RCV determines whether the password from the CCU is correct, and ifso (YES in S30), the system determines whether a time period that thedrop elbow switch was on was less than a preset period, e.g., 3 seconds(S42). If so, (YES in S42), the system opens the valve in the servicemode (S43) and closes the valve (S44) if the drop elbow switch is on orif the service mode time delay has passed. If the time period that thedrop elbow switch is on is long (NO in S42), the system checks whetherany other RCV is in active delivery (S31) with a fuel type that isdifferent from the one requested by the CCU (the system can allow formore than one delivery at the same time if the fuel type (or product) ofthe second delivery is identical to the active delivery and alsoassuming that the CCU has an additional fuel type indicator and pushbutton (i.e., “resources”) for that type of fuel). If so (YES in S31),the system waits until the active delivery for the other RCV iscompleted (S45). If the password is incorrect (NO in S30), the processreturns to step S28, and the RCV returns to sleep mode. If there are noother RCVs in active delivery (NO in S31), the system checks whether theCCU has enough resources to manage the delivery (S46). If not (NO inS46), the process goes to step S45, and if so (YES in S46), the CCUdisplay blinks a product type LED red, and an audible alarm alerts thatthe RCV is closed (S32). The delivery person verifies that the blinkingproduct-type LED matches the product type displayed on the PTDU andpresses the fuel type pushbutton to start delivery (S33). If therequested product type matches the RCV product type (YES in S34), theCCU issues an “open valve” command to the RCV, turns off the audiblealarm and visual alert, turns the product type LED to solid green, andproduct delivery commences (S35). If the requested product type does notmatch the RCV product type (NO in S34), a rejection tone sounds (S36)and the process returns to step S32.

Upon completion of delivery, the delivery person disconnects the dropelbow (S37). With the drop elbow disconnected, the RCV wakes up andsends a completion message to the CCU and begins a countdown (e.g., oneminute) to close the valve (S38). If a “close” command from the CCU isreceived or the countdown limit is completed (YES in S39), the RCV isclosed and enters the sleep mode (S40). The system waits for a “close”command from the CCU or completion of the time out period. In step S41,the system checks whether a drop elbow is connected, and if not (NO inS41), delivery is complete. If a drop elbow is connected (YES in S41),the process returns to step S25.

FIG. 5 illustrates operational processes relating to alert sounds by theCCU to notify the delivery person on exceptions that occur during theunloading process. As shown, several conditions will activate the alarm,and the alarm may be provided with varying tones to signify differenterrors, problems or successes. For example, with reference to FIG. 5,with a drop elbow engaged, the alarm may sound a drop elbow engagedtone. An error tone may be sounded if an error condition is detected,and an alarm tone may be sounded if an alarm condition is detected. Thealarm may similarly include warning beats when the RCV is closed withthe drop elbow engaged. After a user requests that the valve be opened,if the request is accepted, the alarm can sound an “acceptance” tone;otherwise, the alarm can sound a “rejection” tone. At that time, if thedrop elbow is removed, the buzzer/alarm is silenced. If the drop elbowremains detected, the RCV closed warning beeps continue until an openvalve request is accepted.

The CCU is also designed to collect RCV maintenance and operationalstatus at the station and will store that data in its internal memory tosupport product maintenance.

The invention and the operational process described above result inincreased distributor revenue, improved product quality, the eliminationof improper-product delivery, and insurance cost savings.

The described system serves to prevent the unauthorized delivery ofproduct, allow authorized delivery, and control the flow of product atthe entry port of a bulk storage tank. The system prevents anunauthorized delivery vehicle that is hauling a product from loading orunloading cargo while enabling an authorized delivery vehicle to unloador load authorized cargo with minimal interruption. The describedembodiments are most preferably deployed in the area of fueldistribution, but the embodiments are equally applicable to any otherproduct that involves controlling the transfer of product into or out ofa bulk storage tank and a delivery vehicle, such as a tanker truck orrail car.

While the invention has been described in connection with what ispresently considered to be the most practical and preferred embodiments,it is to be understood that the invention is not to be limited to thedisclosed embodiments, but on the contrary, is intended to cover variousmodifications and equivalent arrangements included within the spirit andscope of the appended claims.

What is claimed is:
 1. A method of preventing contamination by a tankertruck in a bulk liquid storage tank, the method comprising: (a)positioning an identification transmitter at an entry port of the bulkliquid storage tank, the identification transmitter storing anindication of a storage product type in the bulk storage tank; (b)communicating a delivery product type in the tanker truck to controlcircuitry in the tanker truck; (c) the identification transmittercommunicating the storage product type to the control circuitry; and (d)the control circuitry comparing the delivery product type with thestorage product type and controlling delivery based on a result of thecomparison.
 2. A method according to claim 1, wherein the identificationtransmitter comprises a remote controlled valve (RCV), wherein the entryport is closed by the RCV.
 3. A method according to claim 2, furthercomprising, prior to step (d), detecting a drop elbow attached to theRCV, and then, establishing the communication between the RCV and thecontrol circuitry.
 4. A method according to claim 3, wherein afterestablishing the communication between the RCV and the controlcircuitry, the method comprises the control circuitry communicating apassword to the RCV.
 5. A method according to claim 4, furthercomprising the control circuitry issuing an open valve command to theRCV when the delivery product type matches the storage product type, anddisplacing the RCV to an open position for delivery.
 6. A methodaccording to claim 1, wherein step (b) is practiced wirelessly.
 7. Amethod according to claim 1, further comprising preventing delivery whenthe delivery product type does not match the storage product type instep (d).
 8. A method according to claim 7, further comprising soundingan alarm when the delivery product type does not match the storageproduct type in step (d).
 9. A system for preventing contamination by atanker truck in a bulk liquid storage tank, the system comprising: anidentification transmitter positioned adjacent an access to the bulkliquid storage tank, the identification transmitter being configured tostore an indication of a storage product type in the bulk storage tank;a drop elbow connecting the tanker truck to the liquid storage tank,wherein the identification transmitter includes a sensor that isconfigured to identify when the drop elbow has been connected; andcontrol circuitry communicating with the identification transmitter, thecontrol circuitry being configured to identify a delivery product typein the tanker truck and to compare the delivery product type in thetanker truck with the storage product type, wherein the controlcircuitry is configured to control delivery of the delivery product typebased on a result of the comparison.
 10. A system according to claim 9,wherein the identification transmitter is disposed adjacent an entryport of the bulk liquid storage tank.